What is the purpose of the Linux SLUB allocator compared to the legacy SLAB and SLOB allocators?

The SLUB allocator (introduced by Christoph Lameter in Linux 2.6.22) is the default kernel object allocator. Unlike legacy SLAB, which maintained complex per-CPU object queues and off-slab metadata queues, SLUB stores slab metadata directly in the struct page / struct slab descriptor and implements a lockless per-CPU fast path. SLOB was designed for embedded micro-systems with minimal memory, while SLUB scales efficiently to massive multi-core, multi-NUMA servers with zero queue synchronization overhead.

How does the SLUB lockless per-CPU fast-path work during kmalloc()?

Each CPU core maintains a kmem_cache_cpu structure referencing an active slab page. The fast-path allocator reads the lockless freelist pointer (c->freelist). If an object is available, the kernel updates c->freelist = get_freepointer(s, object) using a single CMPXCHG local operation without taking any global or NUMA spinlocks. If c->freelist is empty, the thread enters the slow path (__slab_alloc), acquiring the per-node partial list spinlock to refill or allocate a new page from the buddy allocator.

What is CONFIG_SLAB_FREELIST_HARDENED and how does it prevent heap exploitation?

In modern Linux kernels, CONFIG_SLAB_FREELIST_HARDENED protects in-object freelist pointers from being overwritten by heap buffer overflows or Use-After-Free (UAF) attacks. Instead of storing raw pointers in memory, each freelist pointer is XOR-obfuscated with a per-cache 64-bit random cookie and the address of the object itself: obfuscated_ptr = ptr ^ random_cookie ^ ptr_addr. If an attacker blindly overwrites the pointer, the XOR inverse yields an invalid or unmapped address, triggering a kernel panic (BUG_ON) before an attacker can hijack control flow.

What is Object Caging and how does it separate sensitive kernel objects?

Object Caging (or slab segregation / SLAB_VIRTUAL / KMALLOC_CGROUP) isolates sensitive kernel objects (such as struct cred, file descriptors, network sk_buffs, or eBPF maps) into dedicated slab caches rather than generic kmalloc-* pools. This prevents attackers from overlapping an easily corruptible general-purpose heap chunk with high-privilege credentials or function pointers.

Linux SLUB Allocator, Slab Caches & Object Caging Architecture Studio

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Linux SLUB Allocator & Slab Caches Studio

Kernel memory allocator simulator modeling kmem_cache structures, per-CPU lockless freelists, NUMA partial slabs, and hardened pointer obfuscation.

Linux Kernel 5.x / 6.x

Slab Cache Size Class

Hardening & Security Mitigations

Allocation Concurrency / CPU Cores

Simulate Memory Action

Fast Path Lockless Hits

96.8 %

Single CMPXCHG without spinlocks

Slow Path Node Refills

3.2 %

kmem_cache_node partial list lock

Active Slab Objects

24 / 32 in CPU slab

Slab size: 4096 bytes (Order 0)

Freelist Obfuscation

HARDENED

XOR Cookie: 0xa83f9104c27e

SLUB Slab Page Memory Layout & Per-CPU Freelist ● Active Per-CPU Slab Page (Lockless)

Linux Kernel SLUB Implementation (C)

Freelist Pointer Hardening Math

Linux SLUB Allocator & Slab Caches Studio

🔍 Companion Workbenches & Verification Tools

Apache Iceberg & Parquet Columnar Lakehouse Storage Studio

AI Bot Blocker robots.txt Generator

Linux io_uring Provided Buffer Rings Studio | io_uring_register_buf_ring Architecture

PostgreSQL MVCC, Vacuum, Table Bloat & Transaction ID Wraparound Studio

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions